WhatsApp

This page covers the public Subscribe and manage flows for WhatsApp on your status dashboard. For org-wide subscriber admin and bulk import, see WhatsApp subscribers. For message format, delivery logs, STOP/START, and suppression, see WhatsApp notifications.

---

What visitors see

WhatsApp subscriptions let visitors choose which components to watch and receive WhatsApp messages when matching events are created or updated.

On /subscribe, visitors with the WhatsApp channel effectively enabled see a WhatsApp tab where they:

1. Select their country and enter a phone number (validated with international formatting rules; submitted as E.164).
2. Select one or more components from your dashboard (grouped when component groups are enabled).
3. Accept WhatsApp consent and Terms of Service / Privacy Policy checkboxes.
4. Complete the reCAPTCHA check when the dashboard is public (SSO off).
5. Click Subscribe.

They must select at least one component and accept both checkboxes to submit. On public dashboards, Subscribe stays disabled until reCAPTCHA is completed.

Below the subscribe form, an Already subscribed? section lets returning visitors enter their phone number and click Manage to receive a WhatsApp template with a link for updating preferences. The manage-request form also requires reCAPTCHA on public dashboards.

Double opt-in (verification)

WhatsApp subscriptions use double opt-in, parallel to email:

1. The visitor submits the subscribe form.
2. StatusDashboard stores a pending subscriber record and sends a verification WhatsApp template with a short link.
3. The visitor opens the short link from the text (/l/… on the status dashboard host), which resolves to the verification page (/subscribe/whatsapp/verify?token=…).
4. The subscription is activated and the visitor is redirected to a management page.

Verification links expire after 24 hours. If a link expires, the visitor can submit the subscribe form again with the same number (while still unverified).

Managing preferences

After verification — or after requesting a manage link — visitors land on /subscribe/whatsapp/manage?token=…. The management token in the URL (valid for 1 hour) authorizes read and update operations on that number's subscription. SSO does not replace this token — it only controls whether the visitor may reach the page in the first place.

On the manage page, visitors can:

• See their phone number (read-only).
• Add or remove component selections.
• Clear all components and save — they stop receiving notifications but remain subscribed until they change selections again or their manage link expires.
• Return later via Manage on the subscribe page to receive a fresh link.

Each new verification or manage-link WhatsApp template revokes any previous management link for that subscriber, so only the latest link is valid.

Manage and verify texts use temporary short links so messages stay short. Open them on the live status dashboard hostname for that page.

Replying STOP to any status text opts the number out of future delivery (the subscription record stays in place). See WhatsApp notifications — STOP and START.

Subscriber limits

Your plan sets a maximum number of unique phone numbers across your organization — not per dashboard. Pending and verified subscriptions both count when a number is new to your org (first public signup, admin add, or import).

• Each new unique number consumes one slot at sign-up time (before verification completes).
• The same number subscribing on a second status dashboard does not use an additional slot.
• When the org-wide limit is reached, new numbers receive an error at submit time. Numbers already in your organization may still subscribe on other dashboards.
• The Subscribe link remains visible; capacity is enforced when visitors submit the form.

If a visitor never completes verification, the pending record expires after 24 hours and the quota slot is released automatically. It may take up to an additional 48 hours for removal to process — during that window a slot may still appear used in the admin quota bar. See Quota bar.

Separately, your plan may include a monthly WhatsApp messages quota for outbound event and subscription texts. See WhatsApp notifications.

What admins control vs. what visitors control

There is no admin-managed (locked) option for WhatsApp — that concept applies only to email (for example distribution lists). See Email subscribers — Admin-managed.

Plan entitlement

A channel is offered on the public dashboard only when:

1. Your organization plan includes WhatsApp notifications (whatsappEnabled).
2. You enable WhatsApp on that dashboard's Subscriptions tab.

Subscriber and message quotas control capacity; they are not the on/off switch for the product capability.

Security notes

• When SSO is enabled, visitors must authenticate through your IdP before using subscribe or manage APIs — the same gate as the rest of the dashboard. reCAPTCHA is not shown on SSO-protected dashboards.
• On public dashboards (SSO off), subscribe and manage-request forms require reCAPTCHA. This applies even when an IP allowlist is configured — allowed IPs must still pass the check.
• Subscription actions are always scoped to a phone number proved via verify or manage tokens; SSO identity alone does not grant access to another person's subscription.
• IP allowlist rules still apply to subscribe traffic when configured.
• Management tokens are opaque, short-lived, and passed in the URL for the active session. Treat manage links like password-reset links — do not share them.
• Short links resolve only when opened on the correct status dashboard host for that subscription’s dashboard.